Candidate: CVE-2016-10074
PublicDate: 2016-12-30 19:59:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10074
 https://legalhackers.com/advisories/SwiftMailer-Exploit-Remote-Code-Exec-CVE-2016-10074-Vuln.html
 http://packetstormsecurity.com/files/140290/SwiftMailer-Remote-Code-Execution.html
 http://seclists.org/fulldisclosure/2016/Dec/86
 https://github.com/swiftmailer/swiftmailer/blob/5.x/CHANGES
 https://www.exploit-db.com/exploits/40972/
Description:
 The mail transport (aka Swift_Transport_MailTransport) in Swift Mailer
 before 5.4.5 might allow remote attackers to pass extra parameters to the
 mail command and consequently execute arbitrary code via a \" (backslash
 double quote) in a crafted e-mail address in the (1) From, (2) ReturnPath,
 or (3) Sender header.
Ubuntu-Description:
Notes:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=849626
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_libphp-swiftmailer:
upstream_libphp-swiftmailer: released (5.4.5)
precise_libphp-swiftmailer: ignored (reached end-of-life)
precise/esm_libphp-swiftmailer: DNE (precise was needed)
trusty_libphp-swiftmailer: ignored (reached end-of-life)
trusty/esm_libphp-swiftmailer: DNE (trusty was needed)
vivid/stable-phone-overlay_libphp-swiftmailer: DNE
vivid/ubuntu-core_libphp-swiftmailer: DNE
xenial_libphp-swiftmailer: ignored (end of standard support, was needed)
yakkety_libphp-swiftmailer: ignored (reached end-of-life)
zesty_libphp-swiftmailer: ignored (reached end-of-life)
artful_libphp-swiftmailer: ignored (reached end-of-life)
bionic_libphp-swiftmailer: released (5.4.2-1.1)
cosmic_libphp-swiftmailer: released (5.4.2-1.1)
disco_libphp-swiftmailer: released (5.4.2-1.1)
eoan_libphp-swiftmailer: released (5.4.2-1.1)
focal_libphp-swiftmailer: released (5.4.2-1.1)
groovy_libphp-swiftmailer: released (5.4.2-1.1)
hirsute_libphp-swiftmailer: released (5.4.2-1.1)
impish_libphp-swiftmailer: released (5.4.2-1.1)
jammy_libphp-swiftmailer: released (5.4.2-1.1)
devel_libphp-swiftmailer: released (5.4.2-1.1)